[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-relays] Tor relays source IPs spoofed to mass-scan port 22?

To: tor-relays@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-relays] Tor relays source IPs spoofed to mass-scan port 22?
From: Roger Dingledine <arma@xxxxxxxxxxxxxx>
Date: Tue, 29 Oct 2024 02:01:23 -0400
Delivered-to: archiver@xxxxxxxx
Delivery-date: Tue, 29 Oct 2024 02:01:37 -0400
Dkim-signature: v=1; a=rsa-sha256; c=simple/simple; d=torproject.org; s=2022-eugeni; t=1730181691; bh=Q3tK05JmE+o8NjeV2xYbu1+g8f5ATBhUdgwEKMthdmw=; h=Date:From:To:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: Reply-To:From; b=c8u5uHkRFltEPIL5tJn7vd52Dp24/Nk/54iHi3c2QQ94z9v9nKhxg4j0baPot8n0g uO067tjZpjDDg/+atigRp6eUvc4kARmbOBKoRqCiBF65NrQdYyexWeJieRoqL+gxXy JY5C0YvieGs/u49ldbnXE1qHUM31LUGg4fJikX8Tc6z9Mh10LsBkq2l9wVXiZEc3aJ whxuQhSZi+PKgkNMj5T7yPOhBk1zqzsL4MO8HHJwWPou8ZCJCCINwN6+reDKqF8T5Y U49OAUD3LQ7CA+30qL1uamjgvbSgmWGCvv3bWb3Rs4XHqXNeNK+he/sKTnWRg19iVn rR70bLEmKYUmQ==
In-reply-to: <CA+V6dmizGEo4Y=3tCFmK_xNm7W=d7zh4W=0aypyyzVR+Hn4uoA@mail.gmail.com>
List-archive: <http://lists.torproject.org/pipermail/tor-relays/>
List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>
List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>
List-post: <mailto:tor-relays@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>
References: <CA+V6dmizGEo4Y=3tCFmK_xNm7W=d7zh4W=0aypyyzVR+Hn4uoA@mail.gmail.com>
Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

On Tue, Oct 29, 2024 at 04:33:33AM +0100, Pierre Bourdon wrote:
> Kind of like someone spoofing source IPs to send SYNs
> everywhere.

Sounds right. See
https://gitlab.torproject.org/tpo/network-health/analysis/-/issues/85
where I walked through the analysis, for transparency and to help other
folks learn more about how the internet works.

It is a shame that whoever is sending this traffic clearly wants to
undermine safety on the internet. :(

--Roger

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

Follow-Ups:
- Re: [tor-relays] Tor relays source IPs spoofed to mass-scan port 22?
  - From: Jonathan Proulx

References:
- [tor-relays] Tor relays source IPs spoofed to mass-scan port 22?
  - From: Pierre Bourdon

Prev by Author: [tor-relays] Please check if your relay has fallen out of the consensus
Next by Author: Re: [tor-relays] Please check if your relay has fallen out of the consensus
Previous by thread: [tor-relays] Tor relays source IPs spoofed to mass-scan port 22?
Next by thread: Re: [tor-relays] Tor relays source IPs spoofed to mass-scan port 22?
Index(es):
- Author
- Thread